Gridware retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Gridware retweeted
If there was ever a time to be deploying Microsoft Defender for Identity, it be now! There’s a lot of great new detections announced this October that would go miles into securing your enterprise:
New alerts related to Entra ID:
•Suspicious sign-in via Temporary Access Pass
New alerts related to Active Directory:
•Kerberos privilege escalation using a diamond ticket
•Malicious Kerberos activity and CVE-2025-33073 exploitation attempt
•Malicious request of Data Protection API (DPAPI) master key
•Possible data exfiltration over DNS
•Suspicious Active Directory Certificate Services (AD CS) certificate request
•Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance abuse (ESC8)
•Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance over RPC (ESC11)
•Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1)
•Suspicious Certificate Authority (CA) certificate and private key theft
•Suspicious Kerberos PKINIT authentication (AS-REQ)
•Suspicious Kerberos ticket authorization data
Gridware retweeted
Im a finalist for the Australian information security association Rising Star of the year award and will
Unfortunately be missing the award ceremony today because of uni 😭
Good luck to all the other finalists :3
Gridware retweeted
An under-discussed reason for why AD shipped insecure defaults for 20+ years is that, I believe, the focus was ensuring everyone, everywhere could access/deploy/use everything they already had in their enterprise without issue.
Microsoft serves an absurdly diverse customer base. Every size, budget and operational requirement, from a 10-person office to a global bank. And as a result, AD is the platform most enterprise tooling is built around.
If you bought Windows Server, you expected it to work with everything you owned on day one, with no extra investment. Companies would not have *tolerated* anything short of that and had little aptitie to have to play around with settings with their new, shiny gear to get their old stuff working.
The second problem is that the vendors people used also themselves were not serving security concious products. Riverbed’s WAN optimizers shipped a feature that automatically stopped Windows SMB signing, and its docs argued signing added "little security for a big performance cost". NetApp ONTAP didn’t support LDAP channel binding until 9.10.1 and couldn’t fully disable Kerberos RC4 until 9.12.1. 3CX staff told customers to disable “Digitally sign communications (always)” because their SMB library didn’t support signing.
Microsoft even keeps a public list of products whose vendors state they require SMB1, and it has included Canon, Cisco, F5, IBM, McAfee, NetApp, Sophos, Synology and VMware.
The lack of security concious design by vendors goes beyond LDAP/SMB signing. Veeam Backup & Replication couldn’t run in an NTLM-disabled domain until V12, and even then Veeam staff said NTLM was still required between backup infrastructure servers.
Broadcom’s PAM, a privileged access management product, has a KB stating it was not compatible with AD’s Protected Users group because members can’t use NTLM, digest or CredSSP until version 4.5.1(released May 2024). Passwordstate’s browser based RDP fails for Protected Users accounts, and the vendor confirmed there’s no way to authenticate them in the browser.
Considering the state of technology when AD was released and even till this day; Secure defaults would have broken the average enterprise on install. So Microsoft shipped for the ecosystem and its customers; which were insecure themselves.
Lax security defaults, I would argue, were less about laziness and a lack of security investment as much as it was a need to cater to as many different customers as possible and ensure that everyone, no matter what they had, could get up and running with AD without issue or hassle.
More recently due to laws, awareness and increased publiclity in the cybersecurity field, we saw that changed is that security became accepted and budgeted for, and vendors caught up (most of the signing and encryption gaps above have since been fixed). Microsoft is now using Win11 24H2 and Server 2025 to force everyone onto settings the average enterprise and its vendors can finally handle such as SMB signing required, LDAP channel binding on, WebDav deprecated and off by default, NTLMv1 disabled/unsupported(WS2025 and Windows 11 24H2), HTTP endpoints such as those in the AD-CS Web enrollment endpoint getting EPA by default on fresh WS2025 etc etc.
Of course it bears saying, there is valid counter points to my thoughts on this. One that comes to mind is that SQL Server has had Extended Protection for Authentication since 2008 R2, but SCCM only added support for it on the site database in version 2409, which was released December 2024.
Gridware retweeted
This month, October 2026, Microsoft will be setting the default value of “BlockNTLMv1SSO” registry key to 1(enforce) instead of 0(audit) on all devices that do not have this registry pre configured in the enterprise.
Microsoft’s continues its commitment to phasing out NTLM, with this year also seeing RC4 enctype deprecation
support.microsoft.com/en-us/…
Gridware retweeted
With PR 2325, you can now expand your ESC8 relay targets in impacket to include CES web enrollment endpoints 🚀
github.com/fortra/impacket/p…
Gridware retweeted
Underrated steps taken to disrupt ClickFix and harden against a lot of initial-access vectors is blocking command interpreters like wscript, cscript, mshta, hh.exe as well as remapping file extensions of interest (.js, .jse, .vbs, .vbe, .wsf, .hta, .chm) to open in Notepad by default instead of executed by interpreters.
This already exists for PowerShell with scripts opening in notepad by default instead of being executed.
Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file.
When a user is later tricked into executing the malicious command, the cached website content is already on the device, loaded, and ready to be executed. This helps to hide the payload script and helps bypass the character limit of the Run dialog.
ClickFix attacks persuade users to execute attacker-supplied commands under the guise of verification or repair. In this specific campaign, a fake lure instructs users to open Windows Run, paste clipboard content and press Enter.
The injected page uses browser caching to stage the larger VBScript payload separately from the Run command. The command invokes cmd.exe to recursively enumerate files whose names start with "f_” in the browser’s profile folder such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles.
It compares each file’s byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants.
The VBScript collects host information through WMI, retrieves v.ps1 from cocojambo[.]us[.]com/alfa, and launches PowerShell without a profile and with execution-policy bypass. A later PowerShell stage downloads the next-stage payload as cab.dat, then reads and executes its contents in a hidden window. The PowerShell stage triggers .NET compilation using csc.exe and cvtres.exe, then launches timeout.exe.
Subsequent payloads load .NET assemblies into memory and inject code into timeout.exe to target browser and device credentials. The injected process launches PowerShell to retrieve another in-memory stage from capsysnet[.]vg and makes outbound connections to ciliabula[.]cc.
The payload modifies the per-user PowerShell registry configuration to use the Bypass execution policy, then unpacks Python with tar.exe and creates a scheduled task that launches a Python payload through pythonw.exe for persistence.
Microsoft Defender provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Possible ClickFix activity”. Defender Antivirus blocks malicious command execution as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.
Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging. Hunt across browser activity, RunMRU registry key, WScript/PowerShell child processes and scheduled tasks, not download events alone. A CAPTCHA should not ask users to run code. Users shouln not paste commands from verification prompts into Run, Terminal or PowerShell and should treats such requests as potential initial access attempts.
ALT Screenshot of website showing a ClickFix lure
Gridware retweeted
3 months of work later, MS-NEGOEX is merged into Impacket 🚀
First big step toward bringing Impacket on Entra ID-joined & hybrid machines.
Next stop is PKU2U, after #2260 gets merged and soon after you will have SMB, LDAP & MSSQL on Azure with the tools you already know 👀
Be sure to check it out, research or/and build on it! Cant wait to see the sort of Azure offsec opportunities that may come out of this : )
github.com/fortra/impacket/p…
Gridware retweeted
If you’ve been using Certify for AD CS often, you may have noticed on many occasions it flags ESC11 even tho your relay fails. Turns it out it’s a bug that arises when Certify can’t read the remote registry on the CA, it automatically assumes/defaults to indicating that ESC11 is there.
Put in a little PR for those that may be curious and have also ran into this github.com/GhostPack/Certify…
Gridware retweeted
Started a OT pentest at work of an admixture controller unit and have been using this resource to consult with informing what I should explore and more importantly, security configurations and their contexts to support providing clients recommendations post engagement embeddedsecurity.io/introduc…
Gridware retweeted
Love to see @codewhisperer84 & @TrustedSec Titanis get new tooling developed on top of it 🔥
Atlas is a network pentesting tool like cme/nxc that’s built on-top of Titanis. New project but I’m sure it’ll grow and develop as Alex builds up Titanis 💪github.com/portbuster1337/At…
Gridware retweeted
Update 2: I noticed some issues while implementing MS-FASP over the weekend and reached out to Microsoft who confirmed that indeed there was an off by one numbering of opnums as well as smth being mislabeled
Turns out I wasn’t going crazy after all 🙃
Gridware retweeted
During an engagement, and in an effort to bypass Crowdstrike, I figured out a new method to locally privilege escalate when having code execution as a Microsoft Virtual account using only a LoLbin(certreq) and some AD-CS magic.
I was successfully able to compromise the target with Crowdstrike present without needing to use potatoe class exploits. I wrote a blog about it here! abdulmhsblog.com/posts/iamma…
Gridware retweeted
Out with the @gridware pentest team for a badminton game. Who says pentesters don’t go outside : )
